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Background 





m PREMISE 


— You own/operate/require/design/or are 
responsible for equipment essential to a 
system/process/activity which may be small or 
large, simple or complex. It may be a future 
plan, or be presently in operation. 


m NEED 


— Reassurance that causes, effects, and risks of 
system failures have been reviewed 
systematically. 
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Background 
pL 
In casual use, “FMEA” also 
= APPROACH: means “FMECA’— the 
Perform an EMEA or FMECA. distinction between the two has 


< FMEA + C = FMECA become blurred. 
e C= Critically = Risk = Severity/Probability Assessment 
e Analogy: PHL / PHA = FMEA / FMECA 
m CLASSICAL FMEA QUESTION (for each system element): 
1. How ( i.e., in what ways) can this element fail (failure modes)? 


2. What will happen to the system and its environment if this element does fail 
in each of the ways available to it (failure effects)? 
m FMEA ORIGIN: 
— FMEA is a tool originated by SAE reliability engineers. It 
continues to be associated by many with reliability engineering. It 
analyzes potential effects caused by system elements ceasing to 
behave as intended. 
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Definitions 





= FAULT: “Failure Modes...” is a 
— Inability to function in a desired manner, or operation | 'lsnomer- some sources 
in an undesired manner, regardless of cause. now call FMEA by 
m FAILURE: another name — “Fault 


Hazard Analysis.” 





— A fault owing to breakage, wear out, compromised 
structural integrity, etc. 
— FMEA does not limit itself strictly to failures, but includes faults. 
m FAILURE MODE: 
— The manner in which a fault occurs, i.e., the way in which the element faults. 


[Element [FallureMode Examples OOOO O 


stretch, break, kink, fray 
contacts closed, contracts open, coil burnout, coil short 


Operator wrong operation to proper item, wrong operation to wrong item, proper operation to 
wrong item, perform too early, perform too late, fail to perform 
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FAILURE EFFECT: 

— The consequence(s) of a failure mode on an operation, function, status of a 
system/process/activity/environment. The undesirable outcome of a fault of a 
system element in a particular mode. The effect may range from relatively 
harmless impairment of performance to multiple fatalities, a major equipment 
loss, and environmental damage, for example. 

* All failures are faults; not all faults are failures. Faults can be caused by 
actions that are not strictly failures. 

e A system that has been shut down by safety features responding properly 
has NOT faulted (e.g., an overtemperature cutoff.) 


* A protective device which functions as intended (e.g., a blown fuse) has 
NOT failed. 


FAILED/FAULTED SAFE: 


— Proper function is compromised, but no further threat of harm exists (e.g., a 
smoke detector alarms in the absence of smoke). 


FAILED/FAULTED DANGEROUS: 


— Proper function is impaired or lost in a way which poses threat of harm (e.g., a 
smoke detector does not alarm in the presence of smoke). 
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FMEA Uses and Practical 
Applications 


1. Identify individual elements/operations within a system 
that render it vulnerable... 


— Single Point Failures 
2. Identify failure effects: 
— FMEA - general description 
— FMECA - specific Severity and Probability 
assessments 
3. Industries that frequently use FMEA: 
— Consumer Products — Automotive/Toys/Home 
Appliances 
— Aerospace, NASA, DoD 
— Process Industries — Chemical Processing 





The Process 





1. Define the system to be analyzed, and obtain necessary 
drawings, charts, descriptions, diagrams, component lists. 
Know exactly what you're analyzing; is it an area, activity, 
equipment? — all of it, or part of it? What targets are to be 
considered? What mission phases are included? 


2. Break the system down into convenient and logical elements. 
System breakdown can be either Functional (according to 
what the System elements "do"), or Geographic/Architectural 
(i.e., according to where the system elements "are"), or both 
(i.e., Functional within the Geographic, or vice versa). 


3. Establish a coding system to identify system elements. 
4. Analyze (FMEA) the elements. 
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The Process: Three Questions to 
Ask/Answer 





1. Will a failure of the system result in intolerable/undesirable loss? If NO, 
document and end the analysis. If YES, see (1.a.). 


1.a.Divide the system into its subsystems*. Ask this questions for 





These each subsystem: Will a failure of this subsystem result in 
"filtering" intolerable/undesirable loss? If NO, document and end the 
questions analysis. If YES, see (1.b). 
pide 1.b. Divide each subsystem into its assemblies. Ask this question for 
i each assembly: Will a failure of this assembly result in 
conserve intolerable/undesirable loss? If NO, document and end the 
manhours. analysis. If YES, continues this questioning through the 
subassembly level, and onward - into the piece-part level if 
necessary. 
2. Foreach analyzed element, what are the Failure Modes? eria 
3. For each failure mode, what are the Failure Effects? alone, guide 





FMEA — General boo 
FMECA - Severity and Probability assessments 


* Treat interfaces, at each level of analysis, as system elements at the same that level. 
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FMEA Process Flow 





Identify TARGETS to be protected: (2) Recognizes RISK TOLERANCE "Question: For each element v 
* Personnel * Product * Environment LIMITS (i.e., Risk Matrix È : fae ligt 
* Equipment * Productivity * Other... D In What Ways | Boundaries) a Assembly, then ' 
© “SCOPE” system as to:(a) physical (Modes) Can This z Subassembly, then 
Element Fail...? " 
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boundaries; (b) operating phases 
(e.g., shakedown, startup, 1 
standard run, emergency stop, EZ [MSS "i 
maintenance); and (c) other EN 
assumptions made (e.g., as-is, as- What Are The Consequences (Effects) Pd 
designed, no countermeasures Of Failure In This Mode...? Us 
in place)...etc. "REM MEN 1 1*»*»QnüóÓ ll s cese m LQQ1QQ1Q1QQQi G e 

prane : QUESTIONS: For © Effect x 

each FAILURE MODE... .——— —— — —» 1 2 3 


' What are the 
` EFFECTS?...foreach : ki 
V i T ARG ET? NN f TES t ead . lcu 








Reassess REESE : : 
= : MODE/EFFECT/TARGET : 
i combination : 

M 


i USE RISK MATRIX. 
ı MATRIX must be defined for and 
<A— must match the assessment 
Probability Interval and 
Force/Fleet Size. 










Develop 
Countermeasures 







NV 


Accept 
(Waiver) 


Do the countermeasures introduce NEW hazards?...or, 


(6) Do the countermeasures IMPAIR system performance? 
...if so, develop NEW COUNTERMEASURES 
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System Breakdown Concept 





SYSTEM - a composite of subsystems whose functions are 
integrated to achieve a mission/function (includes materials, 
tools, personnel, facilities, software, equipment) 


SUBSYSTEM - a composite of assemblies whose functions are 
integrated to achieve a specific activity necessary for achieving 
a mission 


ASSEMBLY - a composite of subassemblies 
SUBASSEMBLY - a composite of piece parts 
COMPONENT - a composite of piece parts 

PIECE PART - least fabricated item, not further reducible 


INTERFACE - the interaction point(s) necessary to produce the 
desired/essential effects between system elements (interfaces 
transfer energy/information, maintain mechanical integrity, etc) 
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System Breakdown Concept 


Subsystem 1 





System A 


Subsystem 4 
Subsystem 3 


Subsystem 5 


Subsystem 6 


System P 
Breakdown can . DO NOT overlook 


UEUNE TON AS INTERFACES 
or between system 
“GEOGRAPHIC” ae elements! 


or both 
more ——» JACOBS 
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* 
»»* 
E 
of 











SA = 
Subassembly 


Assembly 1 
Assembly 5 
Assembly 6 


Subsystem 1 


Subsystem 7 





A.1.6.5.3.5 
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C3 contains these piece parts 


Functional vs. Geographic System 
Breakdown 





m FUNCTIONAL: 


— Cooling System Don’t neglect Interface 
— Propulsion System Components — e.g., if an 


— Braking System engine-driven belt powers 
— Steering System both a water pump and a 


power steering system, be 





= Fic... sure to include it as a part of 
m GEOGRAPHIC/ARCHITECTURAL: one or as a separate 
— Engine Compartment Interface Element! 


— Passenger Compartment 
— Dashboard/control Panel 
— Rear End 

— Etc.... 


System Breakdown Example 


Automobile Cooling radiator 
water pump 
coolant 
hoses/clamps 
engine block 
thermostat 
Propulsion fuel Storage, 
delivery, 
carburetor 


Some breakdowns 


combine Functional and spark/ignition Battery, 
Geographic approaches. Bice 
This can help to ensure 


distrib t 
Istrioutor 
thoroughness. 


engine Heads, 
block, 


pistons, 
valves 


transmission more... 


Braking standard more... 
emergency 


Chassis/Body engine comp., 
passenger comp., 
storage comp., 
front bumper, 
rear bumper, 
fenders, 
indicators 


[seeing | oe CdPSCSC~—“—SCS 
SS | me. 
OS [ome EL] 
[operator | — me. | 1] 
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Numerical Coding System 





System: Automobile 


Propulsion -20 Braking - 30 Steering - 40 





Subsystems 





Cooling - 10 





Assemblies} Radiator 10 - 11 









Water Pump 


10-12 Develop/implement a 


Coding System that 
gives each analyzed 
system element a 

unique identification. 


Coolant 
10-13 





Hoses/Clamps 
10-14 


Radiator Body 
10-11-02 


Thermostat Radiator Cap 
10-16 10-11-02 
14 


8671 SVERDRUP 





Engng Block | Subassemblies 





— 
eo 
— 
Ql 


Don’t Overlook These 





m Utilities — electricity, compressed air, cooling water, 
pressurized lube oil, steam, etc. 


Human support activities — e.g., process control 
Interface Elements 

All applicable mission phases (for any potential target) 
ELEMENTS CONVENTIONALLY IGNORED: 


— Passive elements in non-hostile environments — e.g., 
electrical wires 


— Static or non-loaded elements — e.g., decorative trim 


BS 
RUP 


JA 
SVERD 


Typical FMEA Worksheet Information 





General administrative/neading information 
Identification number (from System Breakdown) 
ltem name 

Operational Phase(s) 

Failure mode 

Failure cause 

Failure effect 

Target(s) 

Risk assessment (Severity/Probability/Risk) 

0. Action required/remarks 


SO ES oO ee 


ACOBS 
SVERDRUP 


Failure Modes and Effects Analysis 


FMEA No.:  N/246.n Sheet .11 of _44 
Project No.: Osh-004-92 Date.: 6 Feb ‘92 


Subsystema Illumination ___- SVERDRUP TECHNOLOGY, INC. Prep. by.: R.R. Mohr 


System: Headlamp Controls FAILURE MODES AND EFFECTS ANALYSIS pev. by. S Poeman — 
_ Interval.: __20 years Approved by.: G. Roper 


RISK 
ASSESSMENT ACTION 
REQUIRED/REMARKS 


TR headlamp circuit to 
produce headlamp fail-on, 
w/timed off feature to protect 
battery, or eliminate relay/use 
HD Sw. at panel. 
























2B/cóntacts 
(normally 
open) 


mene of night 
vision/potential 
collisions(s) 

w/unilluminated 
obstacles 






P: Personnel / E: Equipment / T: Downtime / M: Mission / V: Environment ] 
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Example: Heirloom Pressure Cooker” 





OPERATOR: (1) loads cooker, (2) closes/seals lid, (3) connects power, (4) observes 
pressure, (5) times cooking at prescribed pressure, (6) offloads dinner. 


SYSTEM DESCRIPTION: 










Pressure 


Safety : : 
Valve SO Gage Electric coil heats cooker. 
Thermostat controls temperature — 
fa Lid Switch opens > 250? F. 
Clam : 
p Spring-loaded Safety Valve opens on 
i overpressure. 
Dinner Electrical p o, 
Power Pressure gage red zone indicates 
RR overpressure. 


Switch 


High temperature/pressure 
cooks/sterilizes food — tenderizes and 
protects against botulin toxin. 





Prepare an FMEA at component level for cooking (after loading/closing/sealing). 
Targets are personnel (P), product (R), and the pressure cooker itself (E). Ignore 
facility/kitchen and energy consumption. Food is for private use. 


*Source: American Society of Safety Engineers 
1 
uo SVERDRUP 


Failure Modes and Effects Analysis 
Worksheet 





Project No. 








Subsystem: Sverdrup Technology, Inc. pA of 
System: Pressure cooker/food/operator Failure Modes & Effects Analysis Prep. by: 
Probability Interval: 25-year/twice-weekly use FMEA No. : Rev. by: 
Operational Phase(s): Cooking (after load/close/sealing) Approved by: 


RISK 
ITEM/ FAILURE FAILURE FAILURE mr ACTION 
FUNCTIONAL MODE CAUSE EFFECT REQUIRED/ 
IDENT. mn PROB os E REMARKS 
production time 
t 


Closed Corrosion; Faulty | Overpressure protection P 
Manufacture; compromised; IV 
Impacted Food  |thermostat Sw protects; IV 
no immediate effect 
(potential 
explosion/burns) 


mon» 


moU 


Leaks Corrosion; Faulty | Steam burns; increased 
Manufacture production time 
Thermostat Open Defective No heat production; 
Switch mission fails R y 
| 


Closed Defective Continuous heating; 
safety valve protects: 
no immediate effect 
(potential 
explosion/burns) 


P: Personnel / E: Equipment / T: Downtime / R: Product / V: mee ee 
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Failure Modes and Effects Analysis 


Worksheet 


IDENT. ITEM/ FAILURE FAILURE 
NO. | FUNCTIONAL MODE CAUSE 
IDENT. 


RISK 


FAILURE ASSESSMENT 


EFFECT 


RISK 


PROB! CODE 


PG |Pressure False high reading Defective; struck | Dinner undercooked; 
gage bacteria/toxins not 
destroyed; or 
Operator | 
intervenes/interrupts 
rocess (mission 
ails) 
False low reading Defective; struck | Dinner overcooked; 

Safety Valve 
protects/releases steam 
If Thermostat Sw fails 
closed (Potential 
explosion/burns) 


Fracture/thread 
strip 


CLMP | Lid Defective Explosive pressure 
clamp(s) release; flying 
debris/burns 


P: Personnel / E: Equipment / T: Downtime / R: Product / V: Environment D 


ACTION 
REQUIRED/ 
REMARKS 
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Zoological FMEA 




















































































































ACME Coyote Lifter — Model RR.12a 
































“STOP” 
Switch 
(Normally Closed) 
























































eG UP” 
Switch 
(Normally Open) 
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Ji cma Ea 
— o 
82,000 HP 
































=! 


NID 




















Coyote Hoist — System Breakdown 


SUBSYSTEM ASSEMBLY SUBASSEMBLY 


Hoist (A) Motor (A-01) Windings (A-01-A) 

Inboard bearing (A-01-b) 
Outboard bearing (A-01c) 
Rotor (A-01-d) 
Stator (A-01-e) 
Frame (A-01-f) 
Mounting plate (A-01-g) 
Wiring terminals (A-01-h) 

Drum (A-02 


Frame (C-01) 
Lifting Lug (C-02 


) Be 
Cable (D-01) 
Hook (D-02) 
Pulleys (D-03) 


Controls (E) Electrical (E-01-a) START Switch (E-01-a) 
Canine (E-02) FULL UP LIMIT Switch (E-01-b) 
Wiring (E-01-c) 
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FMEA — Coyote Hoist 





Project No. 














"OU -——— Sverdrup Technology, Inc. — 
System: Coyote Hoist Failure Modes & Effects Analysis Prep. by: 
Probability Interval: _4 one-way trips ea. Sat. AM / 25 yrs Rev. by: 
i : Uprisi A : 
Operational Phase(s) risin FMEA No. : pproved by 
IDENT ITEM/ I RISK 
: FAILURE FAILURE FAILURE A| ASSESSMENT ACTION 
NO. FUNCTIONAL MODE CAUSE EFFECT R REQUIRED / 
IDENT. E | sev |PROB| CODE | REMARKS 
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Countermeasures for Single-Point 
Failures 





m Adopt redundancy. (Use dissimilar methods — 
consider common-cause vulnerability. ) 


m Adopt a fundamental design change. 


m Use equipment which is EXTREMELY 
reliable/robust. 


m Use derated equipment. 


m Perform frequent Preventive 
Maintenance/Replacement. Prurge, = 63% 


m Reduce or eliminate service and/or environmental 


stresses. Jano 
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When is an FMEA Best Performed? 


m A FMEA cannot be done until design has 
proceeded to the point that System Elements 
have been selected at the level the analysis 
is to explore. 


m ideally, FMEA is best done in conjunction 
with or soon after PHA efforts. Results can 
be used to identify high-vulnerability 
elements and to guide resource deployment 
for best benefit. An FMEA can be done 
anytime in the system lifetime, from initial 
design onward. 
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Principal Limitations and Abuses 
of FMEA 





m Frequently, human errors and hostile environments 
are overlooked. 


m Because the technique examines individual faults of 
system elements taken singly, the combined effects 
of coexisting failures are not considered. 


m If the system is at all complex and if the analysis 
extends to the assembly level or lower, the process 
can be extraordinarily tedious and time consuming. 


m Failure probabilities can be hard to obtain; obtaining, 
interpreting, and applying those data to unique or 
high-stress systems introduces uncertainty which 
itself may be hard to evaluate. 


FMEA Limitations and Abuses 
a a 


m Sometimes FMEA is done only to satisfy the altruistic 
urge or need to “DO SAFETY.” Remember that the FMEA 
will find and summarize system vulnerability to SPFs, and 
it will require lots of time, money, and effort. How does the 
recipient intend to use the results? Why does he need the 
analysis? 


m Ignoring the role of Mission Phasing. 


m When a facility proprietor learns the facility has 100s of 
1000s of SPFs, frequently he panics, develops SPF 
paranoia, and demands “Critical Items Lists” or “Total 
System Redundification.” This paranoia leads to 1) 
misplaced fear (“This SPF-loaded system is sure to get us 
one day!”) and 2) loss of focus on other, possibly deadlier, 
system threats. 
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FMEA Limitations and Abuses 
[S 


m Single points abound! You encounter them daily, yet continue to 
function. Remember: 

— Each day you (a biological bundle of SPFs with only one brain, 
spinal chord, stomach, bladder, liver, pancreas) 

— Drive your vehicle (a rolling cathedral of SPFs with only one engine, 
brake pedal, carburetor, steering wheel, radio, fuel gage) 

— To work (past a jungle of SPFs - traffic signals, other vehicles, 
bridges) 

— To spend the day (at a facility laden with SPFs — one desk, 
computer, wastebasket) 

— Earning money to buy commodities (filled with SPFs — TV with one 
picture tube, toaster with one cord, phone with one of each 
pushbutton) 


Most system nastiness results from complex threats, not from SPFs — don't 
ignore SPFs, just keep them in perspective. J 
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FMEA Limitations and Abuses 


m Redundifying to reduce the singlepoint threat? 


— Will the amount spend on redundifying exceed the price 
you would pay if the undesired event occurred? Don't 
forget to include the cost of redundant parts, their 
installation, and their upkeep. Don't overlook the need to 
make room and weight allowances for the extra 
equipment. How are you going to protect yourself 
against common-causing? Who decided which of two 
identical items is the "routine-use item" and which is the 
backup? You'll have to devise means for switching from 
one to the other. If it's an automatic switching device, 
don't forget to redundify that element, too! 
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Benefits of FMEA 





m Discover potential single-point failures. 


m Assesses risk (FMECA) for potential, single-element 
failures for each identified target, within each mission 
phase. 

m Knowing these things helps to: 

— Optimize reliability, hence mission accomplishment. 
— Guide design evaluation and improvement. 
— Guide design of system to “fail safe" or crash softly. 
— Guide design of system to operate satisfactorily using 
equipment of "low" reliability. 
— Guide component/manufacturer selection. 
30 JA 
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Benefits of FMEA 
_ETETE EE 


m High-risk hazards found in a PHA can be 
analyzed to the piece-part level using FMEA. 


m Hazards caused by failures identified in the 
FMEA can be added to the PHA, if they 
haven't already been logged there. 


m FMEA complements Fault Tree Analysis and 
other techniques. 
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The FMEA Report 


EXECUTIVE SUMMARY (Abstract of complete report) 


SCOPE OF THE ANALYSIS... 
ir Say what is analyzed and 
Brief System Description "ha i mobanalveod 
Analysis Boundaries == eee: 


Physical Boundaries Targets Recognized/Ignored 
Operational Boundaries Operational Phases 

EMER Human Operator In/Out Exposure Interval 

System Exposed Population Others... 

Author 


Discuss FMEA Method - Strengths/Limitations (Cite Refs.) 


Company A THE ANALYSIS... 
Date Z^ 
Es Present Risk Assessment Matrix (if used) 
State Resolution Level(s) used/how decided QUE UE UC 
Describe Software used (if applicable) A di tached 
Present/Discuss the Analysis Data Results pita O a 





Discuss Trade Studies (if done) Table. 


= "mE 
aj Interpretation of Analysis Results 
Predominant Hazards (Overall "Census" and comments on "Repeaters") 
Comments on High Risk Hazards (High from Severity or Probability? 
Countermeasures Effective?) 
[ Comments on High Severity Risk (Probability acceptably low?) 
— ay Chief Contributors to Overall System Risk 
j CONCLUSIONS AND RECOMMENDATIONS... 
| (Interpret Findings — Is overall Risk under acceptable control? Is further 






Analysis needed?...by what methods?) 


ANALYSIS WORKSHEETS... J 
(Present as table or appendix — use Indenture Coding as 


an introductory Table of Contents) 
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Appendix 


Example FMEA Worksheets 
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Appendix 








System : . Date: 
ý Failure Mode and Effects Analysis 
Indenture Level Sheet of 
Compiled By 


Reference Drawing 


Approved By 


Mission 
Failure Modes| Mission Phase/ Failure Effects Failure |Compensating | Severity 
Operational Detection Provisions 


And Causes Next 
Mode Local Higher Method 
Effects| "9 
Level 


Number Identification 


(Nomenclature) 





Worksheet from 
MIL-STD-1629A 
JACOBS 
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System 
CRITICALITY ANALYSIS 


Indenture Level 
Reference Drawing 
Mission 





FUNCTION] FAILURE MODES| MISSION PHASE/ SEVERITY 


FAILURE PROBABILITY| FAILURE 
AND CAUSES OPERATIONAL EFFECT 


MODE 
FAILURE RATE 
DATA SOURCE 


IDENTIFICATION ITEM/FUNCTIONAL 
NUMBER 


IDENTIFICATION 
(NOMENCLATURE) 





Worksheet from 


MIL-STD-1629A 
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Appendix 








Date: 
Sheet of 
Compiled By 


Approved By 
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Appendix 





Project No. o 
Sane Sverdrup Technology, Inc. =i t 
System: Failure Modes & Effects Analysis Prep. by: 
Probability Interval: Rev. by: 
i : A : 
Operational Phase(s) FMEA No. : pproved by 
IDENT ITEM/ 1 RISK 
. FAILURE FAILURE FAILURE A ASSESSMENT ACTION 
NO. FUNCTIONAL MODE CAUSE EFFECT R RIEK REQUIRED / 
IDENT. F | SEV |PROB| cope | REMARKS 





Sverdrup Technology, Inc. 
Worksheet 


P: P | / E: Equi t / T: Downtime / R: Product / V: Envi jo: 
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